# The Group-IB Module

The Group-IB Module allows you to automatically ingest the reports and events from the Group-IB portal into Liberty91. You will need to already have a license with Group-IB.

To activate this Module, you need to go through 3 simple steps:

1. [Whitelist the Liberty91 IP-address (`34.79.108.60`) in the Group-IB portal](#step-1-whitelist-liberty91s-ip-address)
2. [Generate a personal token in the Group-IB Portal](#step-2-generate-a-personal-token)
3. [Provide your username and token in the Liberty91 Module](#step-3-provide-username-and-token-in-liberty91s-group-ib-module)

### Step 1: Whitelist Liberty91's IP-address

1. Log into your Group-IB account at [**sso.group-ib.com**](https://sso.group-ib.com)
2. Go to '**Help Center'**, at the bottom of the sidebar

<figure><img src="/files/OjxfhMkR5tpnkB2r5CJI" alt="" width="375"><figcaption><p>In the Group-IB portal, go to Help Center</p></figcaption></figure>

3. Go to '**Authentication, access and user management**' (usually the top left card under 'Frequently Asked Questions')
4. You will see your User Details. Click on '**Security and Access**'

<figure><img src="/files/3mWDRpK7LbhTQeFZLLFx" alt="" width="375"><figcaption><p>Click on 'Security and Access' under your username</p></figcaption></figure>

<figure><img src="/files/S0jF3fKpHpqmqvn4nrOx" alt="" width="375"><figcaption><p>add 34.79.108.60 to the list of Trusted IP-addresses</p></figcaption></figure>

5. Click on 'IP white list'. Then add `34.79.108.60` to the list of trusted IP-addresses. *Don't forget to click 'submit' or 'add'!* When you're done, it should look like this:

<figure><img src="/files/6xU6WNJ6R44mshIHjETe" alt="" width="375"><figcaption><p>this is what it should look like when you have successfully added Liberty91's IP-address</p></figcaption></figure>

### Step 2: Generate a Personal Token

1. Now that you have whitelisted Liberty91's IP-address, you can generate a Personal Token under the same Security and Access tab. To do that, click on '**Personal token**'.

<figure><img src="/files/Sf3tEG0I3TyyOOL7qdJs" alt="" width="375"><figcaption><p>Under 'Personal Token', click on 'Generate New Token'</p></figcaption></figure>

2. Under 'Personal Token', click on 'Generate New Token'. Copy that token; you will need in for the next step.

### Step 3: Provide username and token in Liberty91's Group-IB Module

<figure><img src="/files/HQpP57PuD8KMzIfI2xnz" alt="" width="375"><figcaption><p>don't forget to activate your Group-IB Module</p></figcaption></figure>

1. Provide your username (your email address you use to login with) and the token you have just generated in the text fields
2. Select the type of reports you want to import into Liberty91. Note that you can select any type of report, but if your Group-IB license doesn't include the types you select here, they will not be imported.
3. Activate the module by selecting the **'active**' button and click on '**update'**.

Congratulations! You have successfully activated your Group-IB Module in Liberty91. New events from Group-IB should now start to appear in the second (middle) column in your '[Recent Threats](/dashboards/recent-threats-dashboard.md)' dashboard.&#x20;


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.liberty91.com/modules/collection-modules/the-group-ib-module.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.